Microsoft Technology Licensing, LLC

Yuhang Zhu

Peter J Kaufman

Shayak Lahiri

Richard Ivan June

Scott Randall Shell

Sean Anderson Bowles

Igor B Peev

Gaurav Raghu Dhawan

Justin Alexander Hou

Moiz Z Rassiwala

Daniel S Dudugjian

Adeep Singh Cheema

Rama Krishna Samudrala

Jitendrakumar G Koshti

Janani Vasudevan

Lee M Butler

John Chadwell Spaith

Neil Laurence Coles

Daniel Ron Simon

Michael Todd Kramer

Miller Thomas Abel

Peter David Waxman

Feng Yue

Giridhar Viswanathan

Vladimir Holostov

Kinshuman Kinshumann

Hung Minh Dang

Adrian Francisco Teran Guajardo

Bradley M Hammond

Paul Roberts

Jeffrey Michael Paul

Javier Novales

Jonathan Vincent

Josh R Cohen

Tarun Kumar Jain

Prakash Ajay Kumar Suri

Sonia Prabhu

Suresh Natarajan

Justin Hou

Jeffrey M Paul

Embodiments described herein are directed to implementing compliance settings by a computing device for bringing the computing device into compliance with a configuration scenario. For instance, a computing device may receive, from a server, configuration information describing compliance settings for implementing by the computing device to bring the computing device into compliance with a configuration scenario. Moreover, the computing device may identify a state machine indicated by the configuration information that describes a configuration process for implementing the compliance settings and execute the state machine to configure the computing device with the compliance settings.

Implementation of compliance settings by a mobile device for compliance with a configuration scenario

Embodiments described herein are directed to managing device compliance for devices that are connected to an enterprise network. For example, a mobile device manager may provide configuration settings to a computing device, which implements the settings in order to be compliant with an enterprise's data and/or security policy. The mobile device manager also maintains a local reference of each device's configuration settings implemented thereby. When the mobile device manager subsequently performs a determination as to whether the computing device is still in compliance, the mobile device manager simply needs to refer to the local reference to determine the computing device's settings instead of explicitly querying the computing device for its settings. The foregoing techniques may be extended for security baseline compliance determinations, IoT device compliance determinations and compliance determinations for other types of devices, such as devices utilized by business partners of the enterprise that utilize the enterprise's network.

Queryless device configuration determination-based techniques for mobile device management

A device boots in a secure manner that allows measurements reflecting which components are loaded during booting to be generated. Measurements of such components, as well as of a device management agent and the security state of the device, are also obtained. The device management agent accesses an attestation service for an enterprise, which is a collection of resources managed by a management service. The device management agent provides the obtained measurements to the attestation service, which evaluates the measurements and based on the evaluation determines whether the device is verified for use in the enterprise. The management service uses this verification to ensure that the device management agent is running in a secure manner, is accurately providing indications of the state of the device to the management service, and is implementing policy received from the management service.

Device attestation through security hardened management agent

Various technologies described herein pertain to managing multiple enrollments of a computing device into configuration sources. Respective enrollment types for the enrollments into the configuration sources can be detected. Moreover, respective control data for the enrollments into the configuration sources can be set based on the enrollment types. Provisioning elements (e.g., policies, preferences, configuration profiles, and resources) that satisfy the respective control data can be permitted to be applied to the computing device by the configuration sources as part of the enrollments. Further, disparate provisioning elements that fail to satisfy the respective control data can be prevented from being applied to the computing device as part of the enrollments.

Multi-enrollments of a computing device into configuration sources

Various technologies described herein pertain to evaluating configuration compliance of a computing device. The computing device operates in a configuration compliance evaluation mode to test a set of configuration requests for a configuration source. Configuration changes to the computing device can be applied in a virtual machine run on the computing device when operating in the configuration compliance evaluation mode. Responsive to each configuration request being received and when the computing device is operating in the configuration compliance evaluation mode, the computing device can store the configuration request in a data store, apply the configuration request in the virtual machine to cause a configuration change in the virtual machine, and store data for verifying enforcement of the configuration change in the data store. The configuration changes to the computing device applied in the virtual machine can be removed when the computing device discontinues operating in the configuration compliance evaluation mode.

Evaluating configuration requests in a virtual machine

Various technologies described herein pertain to policy management on a mobile device. The mobile device includes a device policy manager system that includes a unified interface component and a policy handler component. The unified interface component is configured to receive policy configuration requests from multiple policy sources, including at least an internal policy source component executed by the mobile device and a device management server external to the mobile device. The policy configuration requests include at least a first policy configuration request (a first policy value for a policy) from a first policy source and a second policy configuration request (a second policy value for the policy) from a second policy source. The policy handler component is configured to resolve the conflict between the first and second policy values based on a conflict resolution technique to set a current policy value for the policy that controls the mobile device.

Device policy manager

A method and system extends the functionality of the Open Mobile Alliance (OMA) Device Management (DM) standard to manage vendor specific configuration parameters and settings. An OMA DM structure is provided as an extension to the tree structure of the OMA DM standard. The OMA DM extension allows selected vendor specific parameters and settings to be managed under the OMA DM protocol.

System and method for an OMA DM extension to manage mobile device configuration settings

A read-only management object is created to contain information relating to firmware components that can be updated. This information includes a component identifier, a component version and a user-friendly name for the component. The information also includes a state identifier that indicates a state of a device that includes firmware components. Information from the management object can be used by other components as part of a firmware update process. An update management object is dynamically created to deliver an update package to the device. The update package can contain updates to multiple firmware components.

Publishing the status of and updating firmware components

Translators are provided that enable automated and remote device configurations in an efficient and abstract manner. In one aspect, a device configuration system is provided. A configuration component stores one or more remote configuration trees for various devices. A translator component maps the remote configuration trees to at least one device configuration tree associated with the respective devices to enable device configuration in an automated manner.

On-the-fly device configuration and management

A system and method of configuring network access parameters of a portable computing device is provided. A portable computing device usually includes wireless networking components and may be used with various wireless networks. A configuration server using a device management protocol, such as the OMA-DM protocol, sends network configuration information to a portable computing device. This configuration information includes network parameters such as network identifiers, encryption keys and authentication credentials. The portable computing device then uses the provided parameters to set its configuration information so that it can access a defined wireless network.

Configuration of WiFi network parameters

The present invention is provides a system and method for managing connectivity objects and their associated parameters for a mobile device. The connectivity parameters are stored in a tree structure. For example, a proxy may be a node in the tree with its connectivity parameters listed as leafs. Similarly, a network access point (NAP) object may be a node within the tree. The parameters stored within the tree may be created, modified, deleted, and queried remotely or locally. Any portion of the tree may be modified or queried without having to send the entire tree to the device. Provisioning and modification of the tree is enabled via eXtensible Markup Language (XML). A wireless access protocol (WAP) sub tree is defined under the proxy object. The NAP object may also be used to help manage Wi-Fi connections and desktop pass-through connections. A vendor specific sub tree is also included within the tree that may be used to contain vendor specific settings.

Connectivity objects under a mobile device management tree

A method and system automatically converts a Wireless Internet Protocol (WAP) Client Provisioning (CP) objects to Open Mobile Alliance (OMA) Device Management (DM) objects. WAP CP is enabled according to XML (eXtensible Markup Language) and defines a standard way to bootstrap mobile device's connectivity settings and application protocol access parameters using XML. OMA DM is also enabled according to XML and provides similar functionality, but is organized according to a mandated tree structure. The present invention automatically converts vendor specific parameters from WAP CP to OMA DM such that the vendor specific parameters are more easily managed by an OMA DM server and client.

System and method for automatic conversion from WAP client provisioning XML represented objects to OMA DM tree structure represented objects

Growing community of inventors

Bellevue, WA, United States of America

Yuhang Zhu